7.1High
CVE-2025-6250Privilege Management for Windows - Elevation of Privilege
Description
Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.
Weakness (CWE):
CWE-424
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| BeyondTrust | Privilege Management for Windows | < <25.4.270 |
References and patches
CPE matches (NVD) (1)
cpe:2.3:a:beyondtrust:privilege_management_for_windows:*:*:*:*:*:*:*:*< 25.4.270